Nessus Vulnerability Management in AWS

Overview

We will create a test network of EC2 instances and install Tenable Nessus in order to scan the network for any vulnerabilities. We will later create a Terraform script to automate the creation of the lab for easy access.

Prerequisites

For this project, we will using AWS as our cloud provider while using terraform to create the instances. High level knowledge of cloud, networking, as well as Terraform is required.

Setup

Create the 2019 Windows instance

In the AWS console, navigate to EC2 and select ‘Launch instances’:

We will be using Windows Server 2019 and the t2.micro instance type:

Create a new .pem key pair and give it a name. Save it as we will need it later.

For network settings, we will allow RDP traffic from anywhere to simplify the lab. You may want to restrict it to only your IP in your case. We will also allow HTTP and HTTPS traffic:

Leave all other options as is and select ‘Launch instance’:

We can now see that the instance has been created and running:

Connect to the Windows instance

Now that the instance is running, Click on the ‘Connect’ button:

Select ‘Get password’:

Upload the .pem key we created during the creation of the instance in order to decrypt the password:

After decrypting the password, save it as we will need it to login to the instance:

Warning:

I am displaying the key as well as the password for demonstration purposes. You should not expose your secrets in production like this!

Now that we have the Administrator password, we can download the RDP file and enter the credentials:

After clicking on the RDP file, select ‘Connect’:

Enter the password you copied earlier:

Select ‘Yes’:

We are now in the instance:

Increase Storage for the Instance

It is crucial to increase storage if you would like to successfully install Nessus. Check the footnote ¹ for more information.

Increase from AWS Console

In the EC2 instance storage tab, click on the Volume ID:

Select ‘Modify’:

Increase the volume size to your preferred (GiB) and select ‘Modify’. For this demonstration, I increased it from 30 (GiB) to 60 (GiB):

Extend Disk in Windows

Go back into the Windows instance and open Disk Management:

You should see a newly unallocated partition. Right click on Disk 0 and select ‘Extend’:

You now have enough storage to install the needed applications.

Install Firefox

In order to download Nessus, we will need to install a web browser that is compatible with modern websites.

Open PowerShell and run:

Invoke-WebRequest -Uri 'https://download.mozilla.org/?product=firefox-latest&os=win64&lang=en-US' -OutFile 'C:\firefox.exe' ; Start-Process 'C:\firefox.exe' /S

This will install Firefox on the instance:

Now that we have a modern browser, we can proceed to the next step.

Install Tenable Nessus in the Windows instance

In the Windows Instance, navigate to the Nessus download site and run the .exe file:

https://www.tenable.com/downloads/nessus?loginAttempted=true

Select ‘Ok’:

Go through the install wizard and agree to the terms and conditions:

Once the wizard is finished, in Firefox, go to https://localhost:8834. Accept the risk and continue:

Tenable Nessus welcome page will pop up:

Register for the Nessus Essentials:

Activate the license you received in your email:

Create a username and password:

Allow for Nessus to download all the necessary items:

Once we are in the portal, we have successfully installed Nessus:

Note

It will take a while for Nessus to download and compile all the necessary plugins.

Create Target Machines

Now that we have Nessus ready, we need to create a couple instances so Nessus can scan the network.

Create 2 instances with the same security group and VPC as the Nessus instance:

Edit Security Group

In order to connect to the Linux based instances, add port 22 to allow SSH.

Network Scanning

Select ‘New Folder’ and give it a name:

Select ‘Create a new scan’:

Basic Network Scanning

Select ‘Basic Network Scan’:

Give the scan a name as well as the targets. Paste the private IP addresses of the two target instances we created. Select ‘Launch’:

The scan will take a while but once it is done we can see the results:

Since these are stock AMIs, there are not that many vulnerabilities found on the target machines.

Findings

Remediation

Automating the Lab

Conclusion

Footnotes

Footnotes

1. I found a couple issues with the Windows instance during the Nessus install was due to the lack of storage on the free tier. Went back and added the increase storage portion to prevent any problems for anyone doing a follow along. ↩